TABLE OF CONTENTS 



I. REAL PARTY IN INTEREST 1 

II. RELATED APPEALS AND INTERFERENCES 1 

III. STATUS OF CLAIMS 2 

IV. STATUS OF AMENDMENTS 2 

V. SUMMARY OF CLAIMED SUBJECT MATTER 2 

VI. GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 4 

VII. ARGUMENT 5 

VIII. CLAIMS APPENDIX 14 

IX. EVIDENCE APPENDIX 18 

X. RELATED PROCEEDINGS APPENDIX 19 



Attorney Docket No. RSW920030258US1 (7161-140U) PATENT 

IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 
BEFORE THE BOARD OF PATENT APPEALS AND INTERFERENCES 

In re Application of : Customer Number: 46320 

Luciano SILVA : Confirmation Number: 7485 

Application No.: 10/759,409 : Group Art Unit: 2154 

Filed: January 16, 2004 : Examiner: J. Park 

For: PROGRAMMATIC ROLE-BASED SECURITY FOR A DYNAMICALLY 
GENERATED USER INTERFACE 

APPEAL BRIEF 

Mail Stop Appeal Brief - Patents 
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P.O. Box 1450 
Alexandria, VA 22313-1450 

Sir: 

This Appeal Brief is submitted in support of the Notice of Appeal filed May 20, 2008, 
wherein Appellant appeals from the Examiner's rejection of claims 4-17. 

I. REAL PARTY IN INTEREST 

This application is assigned to IBM Corporation by assignment recorded on January 16, 
2004, at Reel 04909, Frame 0855. 

II. RELATED APPEALS AND INTERFERENCES 



Appellant is unaware of any related appeals and interferences. 
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III. STATUS OF CLAIMS 

Claims 4-17 are pending and multiply rejected in this Application. Claims 1-3 have been 
cancelled. It is from the multiple rejections of claims 4-17 that this Appeal is taken. 

IV. STATUS OF AMENDMENTS 

The claims have not been amended subsequent to the imposition of the Second and Final 
Office Action dated May 20, 2008 (hereinafter the Second Office Action). 

V. SUMMARY OF CLAIMED SUBJECT MATTER 

1 Referring to Figure 1 and also to independent claim 4, a system for programmatic role- 

2 based security in a dynamically generated user interface is disclosed. An application framework 

3 configured through a deployment descriptor 140 comprises a listing of a set of views, a listing of 

4 associated program logic and a listing of a set of authorized roles for selected ones of the views 

5 (lines 1-9 of paragraph [0020]). A first view 110 is listed in the deployment descriptor and 

6 comprises a linkage to a second view 120 listed in the deployment descriptor 140 (lines 1-3 of 

7 paragraph [0023]). Access checking logic 130 is disposed in the first view 110 and programmed 

8 to omit the linkage where a role of an end user accessing the first view 1 10 is not authorized to 

9 access the second view 120 according to the listing of the set of authorized roles in the 

10 deployment descriptor 140 (lines 1-8 of paragraph [0024]). 

1 1 Referring to Figure 3 and also to independent claim 8, a method for programmatic role- 

12 based security in a dynamically generated user interface is disclosed. In block 330, access to a 

13 rendering of a selected view is authenticated based upon a role of an end user requesting access 

14 to the selected view (lines 5-8 of paragraph [0026]). In blocks 340, 350, the selected view is 
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1 processed to identify a method call to access checking logic (lines 1-6 of paragraph [0027]). In 

2 block 360, the role is compared to a set of roles authorized to access a different view associated 

3 with the access checking logic (lines 6-7 of paragraph [0027]). In block 390, a link to the 

4 different view is disposed in the rendering of the selected view conditional upon the role matches 

5 a role in the set of roles (lines 9-10 of paragraph [0027]). 

6 Referring to Figure 3 and also to independent claim 12, a machine readable storage 

7 having stored thereon a computer program for programmatic role-based security in a 

8 dynamically generated user interface is disclosed. The computer program comprises a routine 

9 set of instructions which when executed by a machine cause the machine to perform the 

10 following steps. In block 330, access to a rendering of a selected view is authenticated based 

1 1 upon a role of an end user requesting access to the selected view (lines 5-8 of paragraph [0026]). 

12 In blocks 340, 350, the selected view is processed to identify a method call to access checking 

13 logic (lines 1-6 of paragraph [0027]). In block 360, the role is compared to a set of roles 

14 authorized to access a different view associated with the access checking logic (lines 6-7 of 

15 paragraph [0027]). In block 390, a link to the different view is disposed in the rendering of the 

16 selected view conditional upon the role matches a role in the set of roles (lines 9-10 of paragraph 

17 [0027]). 

18 Referring to Figure 3 and also to independent claim 16, a method for programmatic role- 

19 based security in a dynamically generated user interface is disclosed. In block 320, a 

20 deployment descriptor is configured to specify a set of roles authorized to access renderings of 

21 different views in a distributable application (lines 4-8 of paragraph [0026]; lines 1-6 of 

22 paragraph [0019]). In blocks 360, 370, external access checking logic is programmed to match a 

23 parameterized role with disposed in the set of roles in the deployment descriptor (lines 6-9 of 
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1 paragraph [0027]). In blocks 340, 360, a server page is composed to include a reference to the 

2 external access checking and to invoke the external access in order to conditionally incorporate a 

3 link to a specific view associated with a specific set of authorized roles (lines lines 3-7 of 

4 paragraph [0027]). 

VI. GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 

1. Claims 4 and 6-17 were rejected under 35 U.S.C. § 103 for obviousness based upon 
Bazinet et al, U.S. Patent Publication No. 2003/0167298 (hereinafter Bazinet), in view of 
Vasandani et al, U.S. Patent No. 6,985,946 (hereinafter Vasandani); and 

2. Claim 5 was rejected under 35 U.S.C. § 103 for obviousness based upon Bazinet in 
view of Vasandani and Schenk, U.S. Patent Publication No. 2006/0004887. 
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VII. ARGUMENT 



1 The Rejection of Claims 4 and 6-17 Under 35 U.S.C. $ 103 for Obviousness 

2 BASED UPON BAZINET IN VIEW OF VASANDANI 

3 For convenience of the Honorable Board in addressing the rejections, claims 6-7 and 17 

4 stand or fall together with independent claim 4; and claims 9-16 stand or fall together with 

5 independent claim 8. 
6 

7 As is evident from Appellants' previously-presented comments during prosecution of the 



8 present Application and from Appellants' comments below, there are questions as to how the 

9 limitations in the claims correspond to features in the applied prior art. In this regard, reference 

10 is made to M.P.E.P. § 1207.02, entitled "Contents of Examiner's Answer." Specifically, the 

1 1 following is stated: 



12 (A) CONTENT REQUIREMENTS FOR EXAMINER'S ANSWER. The examiner's 

13 answer is required to include , under appropriate headings, in the order indicated, the following 

14 items: 
15 

16 (9)(e) For each rejection under 35 U.S.C. 102 or 103 where there are questions 

17 as to how limitations in the claims correspond to features in the prior art even after the 

1 8 examiner complies with the requirements of paragraphs (c) and (d) of this section, the 

1 9 examiner must compare at least one of the rejected claims feature by feature with the 

20 prior art relied on in the rejection. The comparison must align the language of the claim 

21 side-by-side with a reference to the specific page, line number, drawing reference 

22 number, and quotation from the prior art, as appropriate, (emphasis added) 



24 Therefore, if the Examiner is to maintain the present rejections and intends to file an Examiner's 

25 Answer, the Examiner is required to include the aforementioned section in the Examiner's 

26 Answer. 
27 

28 Appellants have compared the statement of the rejection found on pages 2-8 of the 

29 Second Office Action with the statement of the rejection found on pages 6-11 of the First Office 
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1 Action. Upon making this comparison, Appellants have been unable to discover any substantial 

2 differences between the respective statements of the rejection. As such, Appellants proceed on 

3 the basis that the Examiner's sole response to Appellants' First Amendment dated December 4, 

4 2007 (hereinafter the First Response) is found on pages 9-12 of the Second Office Action in the 

5 section entitled "Response to Arguments." 
6 

7 "In rejecting claims under 35 U.S.C. § 103, the examiner bears the initial burden of 

8 presenting a prima facie case of obviousness." 1 The legal conclusion of obviousness is based on 

9 underlying findings of fact including the scope and content of the prior art, the differences 

10 between the prior art and the claims at issue, and the level of ordinary skill in the pertinent arts. 2 

1 1 "Secondary considerations such as commercial success, long felt but unsolved needs, failure of 

12 others, etc., might be utilized to give light to the circumstances surrounding the origin of the 

13 subject matter sought to be patented." 3 Therefore, to properly make a finding of obviousness, a 

14 comparison between the applied prior art and the claims at issue must be made to ascertain the 

15 differences between what is being claimed and the teachings of the applied prior art. Moreover, 

16 before making a proper comparison between the claimed invention and the prior art, the 

17 language of the claims must first be properly construed. 4 This burden has not been met. 
18 

19 



1 InreRiickaert . 9 F.3d 1531, 1532 (Fed. Cir. 1993) (citing In re Oetiker. 977 F.2d 1443, 1445 (Fed. Cir. 1992)). 

2 KSR Int'l Co. v. Teleflex Inc.. 127 S.Ct 1727, 1734 (2007). 

3 Id (quoting Graham v. John Deere Co. of Kansas City , 383 U.S. 1, 17-18 (1966)). 

4 See In re Paulsen . 30 F.3d 1475, 1479 (Fed. Cir. 1994); see also, Panduit Corp. v. Dennison Mfg. Co. . 810 F.2d 
1561, 1567-68 (Fed. Cir. 1987) (In making a patentability determination, analysis must begin with the question, 
"what is the invention claimed?" since "[c]laim interpretation, . . . will normally control the remainder of the 
decisional process"); see Gechter v. Davidson. 116 F.3d 1454, 1460 (Fed. Cir. 1997) (requiring explicit claim 
construction as to any terms in dispute). 
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1 Claim 4 

2 Independent claim 4 is directed to the concept that a first view includes a linkage to a 

3 second view and that access checking logic omits the linkage when an end user, who is accessing 

4 the first view, is not authorized to access the second view. Additionally, as recited in claim 17, 

5 the linkage is displayed when the end user is authorized to access the second view. Independent 

6 claims 8, 12, and 16 are directed to similar concepts. 
7 

8 Regarding the claimed "access checking logic disposed in said first view and 

9 programmed to omit said linkage," the Examiner merely stated "no access." In this regard, 

10 Appellant is entirely unclear how Bazinct teaches the specifically claimed limitations. A user 

11 having "no access" does not necessarily require that the linkage is omitted. Moreover, the 

12 Examiner has failed to establish that the access checking logic is disposed in the first view. 

13 Without the Examiner more clearly explaining the Examiner's analysis, Appellant cannot agree 

14 with the Examiner's assertion that Bazinet teaches these limitations. 
15 



16 On page 7 of the First Office Action, the Examiner asserted the following: 

17 It would have been obvious for one of ordinary skill in the art at the time of the invention 

18 to modify Bazinet to include the method of role based security access as taught by Vasandani in 

1 9 order to efficiently control security access by the user's roles predefined. 
20 



21 It is readily apparent that the Examiner has failed to consider the claimed invention, as a whole . 

22 The Examiner's assertion that it would have been obvious to include role based security access 

23 has no apparent relationship to whether or not linkage is omitted in a first view, as claimed. In 

24 this regard, the Examiner has not explained why one having ordinary skill in the art would 

25 employ role based security access to this function. Moreover, Bazinet already teaches that the 

26 user is authenticated. In this regard, the Examiner has not explained why one having ordinary 
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1 skill in the art would modify Bazinet "to efficiently control security access" when security access 

2 has already been taught as being controlled by Bazinet. 
3 

4 The Examiner's Response 

5 The above-reproduced arguments were previously presented on pages 8-10 of the First 



6 Response. The Examiner's response to these arguments is found on page 10-12 of the Second 

7 Office Action. With regard to Appellants' questions as to the claimed "access checking logic 

8 disposed in said first view and programmed to omit said linkage," the Examiner asserted the 

9 following: 



10 The access checking logic (processing of checking authentication, 406-414 in figure 4) 

11 disposed in the portal application (102 in figure 4) and, the portal application provides the first 

12 view to the client (the portal application generate a page (equivalent to applicant's first view) to 

13 the client, see, e.g., page 3, paragraph [0038] and step 416 in figure 4); and 

14 access checking logic disposed in said first view and programmed to omit said linkage 

1 5 (the portal application generate a page (equivalent to applicant's first view) to the client containing 

16 entries corresponding to the backend applications that the authenticated user can access based on 

1 7 the access privileges of the authenticated user, see, e.g., page 3, paragraphs [0038] and [0039] )(thc 

18 web browser displays on page (502 in figure 5) a list of backend applications allowed for the 

19 authenticated user, which means inherently do not show backend applications (application p, data 

20 4, 510 in figure 5) for the unauthenticated user (user i, 504 in figure 5), see, e.g., page 4, paragraph 

21 [0040] and figure 5). 
22 

23 The Examiner's analysis fails to consider the actual language of the claims. As claimed, 



24 the access logic is within the first view. The Examiner's assertion that the access checking logic 

25 is disposed in the portal application that provides the first view to the client fails to teach this 

26 limitation. Thus, the Examiner has failed to establish that Bazinet teaches the limitations for 

27 which the Examiner is relying upon Bazinet to teach. 
28 



29 Regarding Appellants' arguments as to the Examiner's obviousness analysis, the 

30 Examiner asserted the following: 

31 In response to argument 3), In response to applicant's argument that there is no 

32 suggestion to combine the references, the examiner recognizes that obviousness can only be 
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1 established by combining or modifying the teachings of the prior art to produce the claimed 

2 invention where there is some teaching, suggestion, or motivation to do so found either in the 

3 references themselves or in the knowledge generally available to one of ordinary skill in the art. 

4 See In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988) and In re Jones, 958 F.2d 347, 21 

5 USPQ2d 1941 (Fed. Cir. 1992). 

6 Bazinet teaches the access control by authentication information (the authentication 

7 information includes user name and password combination, data on a smartcard etc, see, e.g., page 

8 3, paragraph [0037]). Vasandani teaches the deficiency of role based access control (a userlD-role 

9 database and a resource-role database for use in a web server to grant access to web resources to 

10 users, see, e.g., col. 2, lines 58-62), though it is obvious to include the user roles in the 

1 1 authentication information. 

12 In this case, the obviousness can be established by modifying the authentication 

13 information taught of Bazinet to produce the claimed invention in the knowledge generally 

14 available to one or ordinary skill in the art. 
15 

16 The Examiner's analysis, however, has failed to respond to Appellants' arguments. As 



17 previously argued, Bazinet already teaches authentication, and the Examiner has failed to 

18 establish any additional benefit arising from the Examiner's proposed modification. As such, one 

19 having ordinary skill in the art, while employing common sense, would not modify a reference 

20 when such a modification produces no identifiable benefit. Therefore, for the reasons presented 

21 above, Appellants respectfully submit that the Examiner has failed to establish that claim 1 is 

22 obvious in view of the combination of Bazinet and Vasandani. 
23 

24 Claims 8 and 12 

25 Regarding claims 8 and 12, the Examiner relied extensive upon Fig. 4 of Bazinet. For 

26 example, regarding the claimed "processing said selected view to identify a method call to access 

27 checking logic," the Examiner cited steps 422-434 in Fig. 4. However, these steps do not 

28 "identify a method call to access checking logic," as claimed. Instead, as described in paragraph 

29 [0042], the user has already been authenticated (see steps 408-414). 
30 

31 The Examiner's response to these argument is found on page 12 of the Second Office 

32 Action and reproduced below: 
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1 The portal application generate a page (equivalent to applicant's first view) to the client 

2 based on the checking authentication process (equivalent to applicant's access checking logic, 406- 

3 414 in figure 4)(see, e.g., page 3, paragraph [0038] and step 416 in figure 4). 

4 Therefore, Bazinet inherently teaches a process of the page to identify with the checking 

5 authentication process. 

6 

7 Yet again, the Examiner's analysis fails to consider the actual language of the claim. 



8 Allegedly generating a page based upon a checking authentication process is not the same as 

9 "processing said selected view to identify a method call to access checking logic," as claimed. In 

10 Bazinet, the alleged accessing checking logic (i.e., the checking authentication process) occurs 

1 1 prior to the alleged first view (i.e., the page) is generated. As such, there is no need for the first 

12 view to include a method call to access checking logic. On this basis alone, Bazinet fails to teach 

13 the limitations for which the Examiner is relying upon Bazinet to teach. 
14 

15 Appellants also submit that the Examiner's reliance upon the doctrine of inherency is 

16 misplaced. Inherency may not be established by probabilities or possibilities. The mere fact that 

17 a certain thing may result from a given set of circumstances is not sufficient to establish 

18 inherency. 5 To establish inherency, the extrinsic evidence must make clear that the missing 

19 element must necessarily be present in the thing described in the reference, and that the necessity 

20 of the feature's presence would be so recognized by persons of ordinary skill. 6 Furthermore, 

21 reference is made to ex parte Schricker , 7 in which the Honorable Board of Patent Appeals and 

22 Interferences stated the following: 

23 However, when an examiner relies on inherency, it is incumbent on the examiner to point to the 

24 "page and line" of the prior art which justifies an inherency theory. Compare , In re Rijckaert , 9 



5 In re Rijckaert , 9 F.3d 1531, 1534, 28 USPQ2d 1955, 1957 (Fed. Cir. 1993) (reversed rejection because inherency 
was based on what would result due to optimization of conditions, not what was necessarily present in the prior art); 
In re Oelrich . 666 F.2d 578. 581-82. 212 USPO 323. 326 (CCPA 1981). 

6 Finnegan Corp. v. ITC , 180 F.3d 1354, 51 USPQ2d 1001 (Fed. Cir. 1999); In re Robertson, 169 F.3d 743, 745, 49 
USPQ2d 1949, 1950-51 (Fed. Cir. 1999); Continental Can Co. USA v. Monsanto Co., 20 USPQ 2d 1746 (Fed. Cir. 
1991); Ex parte Lew , 17USPQ2d 1461 (BPAI 1990). 

7 56 USPQ2d 1723, 1725 (BPAI 2000). 
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1 F.3d 1531, 1533, 28 USPQ2d 1955, 1957 (Fed. Cir. 1993) (when the PTO asserts that there is an 

2 explicit or implicit teaching or suggestion in the prior art, it must indicate where such a teaching or 

3 suggestion appears in the prior art); In re Yates. 663 F.2d 1054, 107, 211 USPQ 1149, 1151 

4 (CCPA 1981). 
5 

6 This burden has not been met. Thus, the Examiner has not established that this limitation is 

7 inherently disclosed by Bazinet. 
8 

9 The Rejection of Claim 5 Under 35 U.S.C. $ 103 for Obviousness based upon 

10 Bazinet in view of Vasandani and Schenk 

1 1 For convenience of the Honorable Board in addressing the rejections, claim 5 stands or 

12 falls together with dependent claim 5. 
13 

14 Claim 5 depends from independent claim 4, and Appellant incorporates herein the 



15 arguments previously advanced in traversing the imposed rejection of claim 1 under 35 U.S.C. § 

16 103 for obviousness based upon Bazinet and Vasandani. The tertiary reference to Schenk does not 

17 cure the argued deficiencies of the combination of Bazinet and Vasandani. Accordingly, even if one 

1 8 having ordinary skill in the art were motivated to modify the combination of Bazinet and Vasandani 

19 in view of Schenk, the proposed combination of references would not yield the claimed invention. 

20 Appellant, therefore, respectfully submits that the imposed rejection of claim 5 under 35 U.S.C. 



21 § 103 for obviousness based upon Bazinet in view of Vasandani and Schenk is not viable. 
22 

23 Conclusion 

24 Based upon the foregoing, Appellant respectfully submits that the Examiner's rejections 

25 under 35 U.S.C. § 103 based upon the applied prior art is not viable. Appellant, therefore, 



11 



Application No.: 10/759,409 

1 respectfully solicits the Honorable Board to reverse the Examiner's rejections under 35 U.S.C. § 

2 103. 
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To the extent necessary, a petition for an extension of time under 37 C.F.R. § 1.136 is 
hereby made. Please charge any shortage in fees due under 37 C.F.R. §§ 1.17, 41.20, and in 
connection with the filing of this paper, including extension of time fees, to Deposit Account 09- 
0461, and please credit any excess fees to such deposit account. 



Date: July 2 1,2008 Respectfully submitted, 



/Scott D. Paul/ 

Scott D. Paul 
Registration No. 42,984 
Steven M. Greenberg 
Registration No. 44,725 
Phone: (561)922-3845 
CUSTOMER NUMBER 46320 
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VIII. CLAIMS APPENDIX 

4. A system for programmatic role-based security in a dynamically generated user 
interface, the system comprising: 

an application framework configured through a deployment descriptor comprising a 
listing of a set of views, a listing of associated program logic and a listing of a set of authorized 
roles for selected ones of said views; 

a first view listed in said deployment descriptor and comprising a linkage to a second 
view listed in said deployment descriptor; and, 

access checking logic disposed in said first view and programmed to omit said linkage 
where a role of an end user accessing said first view is not authorized to access said second view 
according to said listing of said set of authorized roles in said deployment descriptor. 

5. The system of claim 4, wherein said application framework comprises the Struts 
framework. 

6. The system of claim 4, wherein said program logic comprises servlets and wherein 
said views comprise Java server pages (JSPs). 

7. The system of claim 6, further comprising a custom tag disposed in said first view for 
invoking said access checking logic and for omitting said linkage responsive to said access 
checking logic. 
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8. A method for programmatic role-based security in a dynamically generated user 
interface, the method comprising the steps of: 

authenticating access to a rendering of a selected view based upon a role of an end user 
requesting access to said selected view; 

processing said selected view to identify a method call to access checking logic; 

comparing said role to a set of roles authorized to access a different view associated with 
said access checking logic; and, 

disposing a link to said different view in said rendering of said selected view conditional 
upon said role matches a role in said set of roles. 

9. The method of claim 8, wherein said step of authenticating comprises the step of 
comparing said role to a set of roles associated with said selected view to locate a match for said 
role. 

10. The method of claim 9, wherein said locating step comprises the step of parsing a 
deployment descriptor for an application framework hosting said selected view and said different 
view to identify said set of roles. 

11. The method of claim 8, wherein said processing step comprises the step of invoking 
external access checking logic for a located server page tag referencing said access checking 
logic. 
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12. A machine readable storage having stored thereon a computer program for 
programmatic role-based security in a dynamically generated user interface, the computer 
program comprising a routine set of instructions which when executed by a machine cause the 
machine to perform the steps of: 

authenticating access to a rendering of a selected view based upon a role of an end user 
requesting access to said selected view; 

processing said selected view to identify a method call to access checking logic; 

comparing said role to a set of roles authorized to access a different view associated with 
said access checking logic; and, 

disposing a link to said different view in said rendering of said selected view conditional 
upon said role matches a role in said set of roles. 

13. The machine readable storage of claim 12, wherein said step of authenticating 
comprises the step of comparing said role to a set of roles associated with said selected view to 
locate a match for said role. 

14. The machine readable storage of claim 13, wherein said locating step comprises the 
step of parsing a deployment descriptor for an application framework hosting said selected view 
and said different view to identify said set of roles. 

15. The machine readable storage of claim 12, wherein said processing step comprises 
the step of invoking external access checking logic for a located server page tag referencing said 
access checking logic. 
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16. A method for programmatic role-based security in a dynamically generated user 
interface, the method comprising the steps of: 

configuring a deployment descriptor to specify a set of roles authorized to access 
renderings of different views in a distributable application; 

programming external access checking logic to match a parameterized role with disposed 
in said set of roles in said deployment descriptor; and, 

composing a server page to include a reference to said external access checking and to 
invoke said external access in order to conditionally incorporate a link to a specific view 
associated with a specific set of authorized roles. 

17. The system of claim 4, wherein said access checking logic is programmed to display 
said linkage where a role of the end user accessing said first view is authorized to access said 
second view. 
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IX. EVIDENCE APPENDIX 

No evidence submitted pursuant to 37 C.F.R. §§ 1.130, 1.131, or 1.132 of this title or of 
any other evidence entered by the Examiner has been relied upon by Appellant in this Appeal, 
and thus no evidence is attached hereto. 
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X. RELATED PROCEEDINGS APPENDIX 

Since Appellant is unaware of any related appeals and interferences, no decision rendered 
by a court or the Board is attached hereto. 
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